--- title: Exabeam Aa V2 slug: connectors/exabeam-aa-v2 docTags: createdAt: 2026-06-09T16:30:12.323Z --- Exabeam AA v2 is a next-generation SIEM platform that utilizes behavioral analytics to enhance threat detection and response. Exabeam Advanced Analytics (AA) v2 is a powerful platform for security intelligence and management, offering advanced capabilities for threat detection and response. The Exabeam AA v2 connector for Swimlane Turbine enables seamless integration with Exabeam's robust analytics and correlation rule management, event search, and context table management. This integration empowers Swimlane Turbine users to automate complex security workflows, enhance threat detection accuracy, and streamline incident response processes, ultimately improving the efficiency and effectiveness of security operations. ## Prerequisites Before you can use the Exabeam AA v2 connector for Turbine, you'll need access to the Exabeam API. This requires the following: - OAuth 2.0 Client Credentials authentication using the following parameters: - URL: The endpoint for accessing the Exabeam API. - API Key: A unique key provided by Exabeam for API access. - API Key Secret: A secret associated with the API Key for secure authentication. ## Capabilities This connector provides the following capabilities: - Add Context Records - Create A New Correlation Rule - Create Context Table - Delete A Correlation Rule - Get A List Of All Correlation Rules - Get Context Table Metadata - Get Context Table Records - Get Correlation Rule Details - Search For Events - Update A Correlation Rule ### Add Context Records Add one or more context records directly to an existing context table. Use the operation parameter to append the added data or replace the existing data. Exabeam's documentation for this action can be found [here](https://developers.exabeam.com/exabeam/reference/postcontext-managementv1tablesidaddrecords). ### Create Context Table Create a custom context table (only `Custom` tables are supported) with attributes that define the schema. Use the `isKey` property to designate the key attribute. Exabeam's documentation for this action can be found [here](https://developers.exabeam.com/exabeam/reference/postcontext-managementv1tables). ### Get Context Table Metadata Retrieve metadata for all existing context tables, including source, operational status, and attribute mapping. Exabeam's documentation for this action can be found [here](https://developers.exabeam.com/exabeam/reference/getcontext-managementv1tables). ### Get Context Table Records Retrieve the records for a specific context table. Supports pagination via the `limit` and `offset` query parameters. Exabeam's documentation for this action can be found [here](https://developers.exabeam.com/exabeam/reference/getcontext-managementv1tablesidrecords). ## Notes For more information on Exabeam: [Exabeam AA Bi-directional API Documentation](https://docs.exabeam.com/apis/) ## Additional Documentation - [Exabeam Aa V2 Connector Documentation](https://docs.swimlane.com/connectors/exabeam-aa-v2) - [Exabeam Aa V2 API Documentation](https://docs.exabeam.com/apis/) # Configurations ## Oauth 2.0 Client Credentials Authenticates using oauth 2.0 client credentials ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | -------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | client\_id | API Key. | string | Required | | client\_secret | API Key Secret. | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Add Context Records Add context records to an existing table in Exabeam AA v2 using the Context Management API. Requires 'id' as path parameter and 'operation' in JSON body to append or replace data. ### Endpoint - **URL:** `/context-management/v1/tables/{{id}}/addRecords` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.id` | string | Required | ID of an existing context table. | | `operation` | string | Optional | Options for how data should be uploaded to an existing table. Use append to add data or replace to overwrite existing data. | | `data` | array | Optional | String data records. Each record is an object that maps attribute IDs to their values. | ### Input Example `{"json_body":{"operation":"append","data":[{"xym85GfP":"John","GsqqBM5h":"Doe","EiC5olOacm":"email1@server.com"},{"xym85GfP":"Jane","GsqqBM5h":"Smith","EiC5olOacm":"email2@server.com"}]},"path_parameters":{"id":"EiC5olOacm"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | -------------------------------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `trackerId` | string | Tracker ID for the upload operation that can be used to poll ingestion progress. | | `jsonEntries` | number | Number of JSON entries received. | | `totalDuplicates` | number | Number of duplicate entries detected. | | `totalIgnoredMissingKey` | number | Number of records ignored because the key attribute was missing. | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 5 Sep 2023 20:37:23 GMT"},"reason":"OK","json_body":{"jsonEntries":1000,"totalDuplicates":100,"totalIgnoredMissingKey":10,"trackerId":"fbbc124ada3c4ffa94c3c60457512dd3"}}` ## Create A New Correlation Rule Initiate the creation of a new correlation rule in Exabeam AA v2 using the provided JSON body. ### Endpoint - **URL:** `/correlation-rules/v2/rules` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------------------------- | -------- | ------------ | ------------------------------------------- | | `severity` | string | Optional | Parameter for Create A New Correlation Rule | | `enabled` | boolean | Optional | Parameter for Create A New Correlation Rule | | `testMode` | boolean | Optional | Parameter for Create A New Correlation Rule | | `sequencesConfig` | object | Optional | Parameter for Create A New Correlation Rule | | `sequencesConfig.sequences` | array | Optional | Parameter for Create A New Correlation Rule | | `sequencesConfig.sequences.condition` | object | Required | Parameter for Create A New Correlation Rule | | `sequencesConfig.sequences.condition.groupByOption` | boolean | Required | Parameter for Create A New Correlation Rule | | `sequencesConfig.sequences.condition.functionType` | string | Required | Type of the resource | | `sequencesConfig.sequences.condition.subject` | string | Required | Parameter for Create A New Correlation Rule | | `sequencesConfig.sequences.condition.operator` | string | Required | Parameter for Create A New Correlation Rule | | `sequencesConfig.sequences.condition.unit` | string | Required | Parameter for Create A New Correlation Rule | | `sequencesConfig.sequences.condition.triggerOnAnyMatch` | string | Optional | Parameter for Create A New Correlation Rule | | `sequencesConfig.sequences.condition.groupBy` | array | Optional | Parameter for Create A New Correlation Rule | | `sequencesConfig.sequences.condition.field` | string | Optional | Parameter for Create A New Correlation Rule | | `sequencesConfig.sequences.condition.value` | string | Required | Value for the parameter | | `sequencesConfig.sequences.condition.time` | number | Required | Time value | | `sequencesConfig.sequences.name` | string | Required | Name of the resource | | `sequencesConfig.sequences.query` | string | Required | Parameter for Create A New Correlation Rule | | `sequencesConfig.commonProperties` | object | Optional | Parameter for Create A New Correlation Rule | | `sequencesConfig.commonProperties.groupBy` | array | Optional | Parameter for Create A New Correlation Rule | | `sequencesConfig.commonProperties.time` | number | Required | Time value | | `sequencesConfig.commonProperties.unit` | string | Required | Parameter for Create A New Correlation Rule | | `sequencesConfig.outcomes` | object | Optional | Parameter for Create A New Correlation Rule | | `sequencesConfig.outcomes.sendEmail` | boolean | Optional | Parameter for Create A New Correlation Rule | | `sequencesConfig.outcomes.createCase` | boolean | Optional | Parameter for Create A New Correlation Rule | ### Input Example `{"json_body":{"severity":"medium","enabled":true,"testMode":true,"sequencesConfig":{"sequences":[{"condition":{"groupByOption":true,"functionType":"value","subject":"field","operator":"not_in","unit":"hours","triggerOnAnyMatch":"false","groupBy":["string"],"field":"string","value":"string","time":3},"name":"Single sequence rule","query":"vendor:\"Exabeam\""}],"commonProperties":{"groupBy":["string"],"time":3,"unit":"hours"},"outcomes":{"sendEmail":true,"createCase":true,"sendAlertTriage":false,"case":{"description":"Rule is triggered when any event match the sequence query"},"email":{"recipients":["string"],"subject":"string","description":"Rule is triggered when any event match the sequence query","attachCsv":true},"alertTriage":{"name":"Single sequence rule"}}},"suppressConfig":{"suppressOption":true,"suppressUnit":"hours","suppressTime":4},"delayConfig":{"delay":true,"delayTimeInMinutes":5},"name":"Single sequence rule","description":"Rule is triggered when any event match the sequence query"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------------------- | -------- | --------------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `name` | string | Name of the resource | | `description` | string | Output field: description | | `severity` | string | Output field: severity | | `enabled` | boolean | Output field: enabled | | `type` | string | Type of the resource | | `author` | string | Output field: author | | `lastModifier` | string | Output field: lastModifier | | `createdAt` | string | Output field: createdAt | | `updatedAt` | string | Output field: updatedAt | | `autoDisabled` | boolean | Output field: autoDisabled | | `lastTriggeredAt` | string | Output field: lastTriggeredAt | | `timesTriggered` | number | Output field: timesTriggered | | `timesSuppressed` | number | Output field: timesSuppressed | | `sequencesConfig` | object | Output field: sequencesConfig | | `sequencesConfig.sequences` | array | Output field: sequencesConfig.sequences | | `sequencesConfig.sequences.name` | string | Name of the resource | | `sequencesConfig.sequences.query` | string | Output field: sequencesConfig.sequences.query | | `sequencesConfig.sequences.condition` | object | Output field: sequencesConfig.sequences.condition | | `sequencesConfig.sequences.condition.groupByOption` | boolean | Output field: sequencesConfig.sequences.condition.groupByOption | | `sequencesConfig.sequences.condition.groupBy` | array | Output field: sequencesConfig.sequences.condition.groupBy | | `sequencesConfig.sequences.condition.functionType` | string | Type of the resource | | `sequencesConfig.sequences.condition.subject` | string | Output field: sequencesConfig.sequences.condition.subject | ### Output Example `{"status_code":201,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 5 Sep 2023 20:37:23 GMT"},"reason":"OK","json_body":{"id":"3fa85f64-5717-4562-b3fc-2c963f66afa6","name":"string","description":"string","severity":"none","enabled":true,"type":"string","author":"string","lastModifier":"string","createdAt":"2023-09-06T10:08:31.303Z","updatedAt":"2023-09-06T10:08:31.303Z","autoDisabled":true,"lastTriggeredAt":"2023-09-06T10:08:31.303Z","timesTriggered":0,"t...` ## Create Context Table Create a custom context table in Exabeam AA v2 with attributes defining the schema. Requires json\_body including name, contextType, and source. ### Endpoint - **URL:** `/context-management/v1/tables` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------ | | `name` | string | Optional | Table display name. | | `contextType` | string | Optional | A valid context type for creating a table. | | `source` | string | Optional | The vendor from which the table will be sourced. Only Custom is supported. | | `attributes` | array | Optional | Table metadata attributes. Each attribute may either reference an existing attribute by id or define a new attribute by displayName. | | `attributes.id` | string | Optional | ID of an existing attribute (use either id or displayName). | | `attributes.displayName` | string | Optional | Attribute display name (used when creating a new attribute). | | `attributes.isKey` | boolean | Required | Indicates whether the attribute is the key for the table. | ### Input Example `{"json_body":{"name":"Example Custom table of type Other","contextType":"Other","source":"Custom","attributes":[{"displayName":"Custom Attribute","isKey":false},{"id":"id_of_existing_attribute","isKey":true}]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------ | -------- | ---------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `url` | string | URL endpoint for the request | | `table` | object | Output field: table | | `table.id` | string | Unique identifier | | `table.name` | string | Name of the resource | | `table.contextType` | string | Type of the resource | | `table.source` | string | Output field: table.source | | `table.totalItems` | number | Output field: table.totalItems | | `table.status` | string | Status value | | `table.lastUpdated` | number | Output field: table.lastUpdated | | `table.attributes` | array | Output field: table.attributes | | `table.attributes.id` | string | Unique identifier | | `table.attributes.displayName` | string | Name of the resource | | `table.attributes.type` | string | Type of the resource | | `table.attributes.isKey` | boolean | Output field: table.attributes.isKey | | `table.attributeMapping` | array | Output field: table.attributeMapping | | `table.attributeMapping.sourceAttribute` | string | Output field: table.attributeMapping.sourceAttribute | | `table.attributeMapping.targetAttributeId` | string | Unique identifier | ### Output Example `{"status_code":201,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 5 Sep 2023 20:37:23 GMT"},"reason":"Created","json_body":{"url":"https://example.com/context-management/v1/tables/EiC5olOacm","table":{"id":"EiC5olOacm","name":"Public API Example","contextType":"Other","source":"Custom","totalItems":10,"status":"RUNNING","lastUpdated":1676018946,"attributes":[],"attributeMapping":[]}}}` ## Delete A Correlation Rule Delete a specific correlation rule in Exabeam AA v2 using the provided rule-id. ### Endpoint - **URL:** `/correlation-rules/v2/rules/{{rule-id}}` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | --------------------------------------------------- | | `path_parameters.rule-id` | string | Required | Parameters for the Delete A Correlation Rule action | ### Input Example `{"path_parameters":{"rule-id":"016dbc1d-a727-4"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 5 Sep 2023 20:37:23 GMT"},"reason":"OK","json_body":{}}` ## Get A List Of All Correlation Rules Retrieve a comprehensive list of all correlation rules available in Exabeam AA v2. ### Endpoint - **URL:** `/correlation-rules/v2/rules` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 5 Sep 2023 20:37:23 GMT"},"reason":"OK","json_body":[{"id":"4e775ff5-78c1-4b2d-81fd-26be2632f042","name":"Rule triggered when a certain field does not match values in the list","enabled":true,"description":"Rule is triggered when none of the defined values are present.","severity":"none","author":"Admin","lastModifier":"Standard User","createdAt":"2023-06-25T14:48:00.000Z","updatedAt":"20...` ## Get Context Table Metadata Retrieve metadata for all existing context tables in Exabeam AA v2 via the Context Management API, including source, operational status, and attribute mapping. ### Endpoint - **URL:** `/context-management/v1/tables` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 5 Sep 2023 20:37:23 GMT"},"reason":"OK","json_body":[{"id":"EiC5olOacm","name":"Public API Example","contextType":"Other","source":"Custom","totalItems":10,"status":"RUNNING","lastUpdated":1676018946,"attributes":[],"attributeMapping":[]}]}` ## Get Context Table Records Retrieve records for a specific context table in Exabeam AA v2 using the Context Management API with the table ID as a path parameter. ### Endpoint - **URL:** `/context-management/v1/tables/{{id}}/records` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | -------------------------------------------------------------- | | `path_parameters.id` | string | Required | ID for the specified context table. | | `query_parameters.limit` | number | Optional | The number of records to return per page. | | `query_parameters.offset` | number | Optional | The number of rows to skip before beginning to return records. | ### Input Example `{"path_parameters":{"id":"EiC5olOacm"},"query_parameters":{"limit":25,"offset":0}}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `paging` | object | Output field: paging | | `paging.count` | number | Count value | | `paging.limit` | number | Output field: paging.limit | | `paging.offset` | number | Output field: paging.offset | | `paging.pages` | number | Output field: paging.pages | | `paging.next` | array | Output field: paging.next | | `paging.prev` | array | Output field: paging.prev | | `records` | array | Output field: records | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 5 Sep 2023 20:37:23 GMT"},"reason":"OK","json_body":{"paging":{"count":3,"limit":25,"next":[],"offset":0,"pages":1,"prev":[]},"records":[{},{},{}]}}` ## Get Correlation Rule Details Retrieve detailed information for a specific correlation rule in Exabeam AA v2 using the rule-id path parameter. ### Endpoint - **URL:** `/correlation-rules/v2/rules/{{rule-id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ------------------------------------------------------ | | `path_parameters.rule-id` | string | Required | Parameters for the Get Correlation Rule Details action | ### Input Example `{"path_parameters":{"rule-id":"016dbc1d-a727-4"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------------------- | -------- | --------------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `name` | string | Name of the resource | | `enabled` | boolean | Output field: enabled | | `description` | string | Output field: description | | `severity` | string | Output field: severity | | `author` | string | Output field: author | | `lastModifier` | string | Output field: lastModifier | | `createdAt` | string | Output field: createdAt | | `updatedAt` | string | Output field: updatedAt | | `autoDisabled` | boolean | Output field: autoDisabled | | `lastTriggeredAt` | string | Output field: lastTriggeredAt | | `timesTriggered` | number | Output field: timesTriggered | | `timesSuppressed` | number | Output field: timesSuppressed | | `sequencesConfig` | object | Output field: sequencesConfig | | `sequencesConfig.sequences` | array | Output field: sequencesConfig.sequences | | `sequencesConfig.sequences.name` | string | Name of the resource | | `sequencesConfig.sequences.query` | string | Output field: sequencesConfig.sequences.query | | `sequencesConfig.sequences.condition` | object | Output field: sequencesConfig.sequences.condition | | `sequencesConfig.sequences.condition.groupByOption` | boolean | Output field: sequencesConfig.sequences.condition.groupByOption | | `sequencesConfig.sequences.condition.functionType` | string | Type of the resource | | `sequencesConfig.sequences.condition.subject` | string | Output field: sequencesConfig.sequences.condition.subject | | `sequencesConfig.sequences.condition.field` | string | Output field: sequencesConfig.sequences.condition.field | | `sequencesConfig.sequences.condition.operator` | string | Output field: sequencesConfig.sequences.condition.operator | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 5 Sep 2023 20:37:23 GMT"},"reason":"OK","json_body":{"id":"4e775ff5-78c1-4b2d-81fd-26be2632f042","name":"Rule with more than one sequence that triggers when the conditions of both seque...","enabled":true,"description":"Rule is triggered when the conditions of both sequences are met. In this example...","severity":"none","author":"Admin","lastModifier":"Standard User","createdAt":"2023-06...` ## Search For Events Perform a search across logs and events within a specified time range using Exabeam AA v2, requiring fields, startTime, endTime, and filter. ### Endpoint - **URL:** `/search/v2/events` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ---------------------------------------------------------------------- | | `limit` | number | Optional | Limit the number of events returned from the search request. | | `groupBy` | array | Optional | List of fields to GROUP BY. | | `orderBy` | array | Optional | Order fields by ASC or DESC. | | `distinct` | boolean | Optional | Include or exclude DISTINCT from the SELECT clause. Defaults to false. | | `startTime` | string | Optional | Timestamp to start the search (ISO-8601 format). | | `endTime` | string | Optional | Timestamp to end the search (ISO-8601 format). | | `filter` | string | Optional | Filter for specific events. | ### Input Example `{"json_body":{"limit":3000,"groupBy":["string"],"orderBy":["ASC"],"distinct":true,"startTime":"2024-04-01T00:00:00Z","endTime":"2024-04-01T00:00:00Z","filter":"id:\"123\" AND src_ip:\"00.00.000.000\""}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------- | -------- | --------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `timeStartedMillis` | number | Output field: timeStartedMillis | | `timeCompletedMillis` | number | Output field: timeCompletedMillis | | `rows` | array | Output field: rows | | `rows.additionalProp` | object | Output field: rows.additionalProp | | `totalRows` | number | Output field: totalRows | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 5 Sep 2023 20:37:23 GMT"},"reason":"OK","json_body":{"timeStartedMillis":0,"timeCompletedMillis":0,"rows":[{}],"totalRows":0}}` ## Update A Correlation Rule Update an existing correlation rule in Exabeam AA v2 using the specified rule-id. Requires path parameters and a JSON body. ### Endpoint - **URL:** `/correlation-rules/v2/rules/{{rule-id}}` - **Method:** `PUT` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------------------------- | -------- | ------------ | --------------------------------------------------- | | `path_parameters.rule-id` | string | Required | Parameters for the Update A Correlation Rule action | | `severity` | string | Optional | Parameter for Update A Correlation Rule | | `enabled` | boolean | Optional | Parameter for Update A Correlation Rule | | `testMode` | boolean | Optional | Parameter for Update A Correlation Rule | | `sequencesConfig` | object | Optional | Parameter for Update A Correlation Rule | | `sequencesConfig.sequences` | array | Optional | Parameter for Update A Correlation Rule | | `sequencesConfig.sequences.condition` | object | Optional | Parameter for Update A Correlation Rule | | `sequencesConfig.sequences.condition.groupByOption` | boolean | Required | Parameter for Update A Correlation Rule | | `sequencesConfig.sequences.condition.functionType` | string | Required | Type of the resource | | `sequencesConfig.sequences.condition.subject` | string | Required | Parameter for Update A Correlation Rule | | `sequencesConfig.sequences.condition.operator` | string | Required | Parameter for Update A Correlation Rule | | `sequencesConfig.sequences.condition.unit` | string | Required | Parameter for Update A Correlation Rule | | `sequencesConfig.sequences.condition.triggerOnAnyMatch` | string | Optional | Parameter for Update A Correlation Rule | | `sequencesConfig.sequences.condition.groupBy` | array | Optional | Parameter for Update A Correlation Rule | | `sequencesConfig.sequences.condition.field` | string | Optional | Parameter for Update A Correlation Rule | | `sequencesConfig.sequences.condition.value` | string | Required | Value for the parameter | | `sequencesConfig.sequences.name` | string | Optional | Name of the resource | | `sequencesConfig.sequences.query` | string | Required | Parameter for Update A Correlation Rule | | `sequencesConfig.commonProperties` | object | Optional | Parameter for Update A Correlation Rule | | `sequencesConfig.commonProperties.time` | number | Optional | Time value | | `sequencesConfig.commonProperties.unit` | string | Optional | Parameter for Update A Correlation Rule | | `sequencesConfig.outcomes` | object | Optional | Parameter for Update A Correlation Rule | | `sequencesConfig.outcomes.sendEmail` | boolean | Optional | Parameter for Update A Correlation Rule | | `sequencesConfig.outcomes.createCase` | boolean | Optional | Parameter for Update A Correlation Rule | | `sequencesConfig.outcomes.sendAlertTriage` | boolean | Optional | Parameter for Update A Correlation Rule | ### Input Example `{"json_body":{"severity":"high","enabled":false,"testMode":true,"sequencesConfig":{"sequences":[{"condition":{"groupByOption":true,"functionType":"value","subject":"field","operator":"in","unit":"days","triggerOnAnyMatch":"false","groupBy":["string"],"field":"string","value":"string","time":3},"name":"Single sequence rule","query":"vendor:\"Exabeam\""},{"condition":{"triggerOnAnyMatch":"true"},"name":"Single sequence rule","query":"vendor:\"Exabeam\""},{"condition":{"groupByOption":true,"functionType":"value","subject":"field","operator":"more_than","unit":"days","triggerOnAnyMatch":"false","groupBy":["string"],"field":"string","value":"string"},"name":"Single sequence rule","query":"vendor:\"Exabeam\""}],"commonProperties":{"time":2,"unit":"hours"},"outcomes":{"sendEmail":true,"createCase":true,"sendAlertTriage":true,"case":{"description":"Rule is triggered when any of the events match the search query."},"email":{"recipients":["string"],"subject":"string","description":"Rule is triggered when any of the events match the search query.","attachCsv":false},"alertTriage":{"name":"Single sequence rule"}}},"suppressConfig":{"suppressOption":true,"suppressUnit":"hours","suppressTime":2},"delayConfig":{"delay":true,"delayTimeInMinutes":7},"name":"Single sequence rule","description":"Rule is triggered when any of the events match the search query."},"path_parameters":{"rule-id":"016dbc1d-a727-43df-a143-9546dcc81a5a"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------------------- | -------- | --------------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `name` | string | Name of the resource | | `description` | string | Output field: description | | `severity` | string | Output field: severity | | `enabled` | boolean | Output field: enabled | | `type` | string | Type of the resource | | `author` | string | Output field: author | | `lastModifier` | string | Output field: lastModifier | | `createdAt` | string | Output field: createdAt | | `updatedAt` | string | Output field: updatedAt | | `autoDisabled` | boolean | Output field: autoDisabled | | `lastTriggeredAt` | string | Output field: lastTriggeredAt | | `timesTriggered` | number | Output field: timesTriggered | | `timesSuppressed` | number | Output field: timesSuppressed | | `sequencesConfig` | object | Output field: sequencesConfig | | `sequencesConfig.sequences` | array | Output field: sequencesConfig.sequences | | `sequencesConfig.sequences.name` | string | Name of the resource | | `sequencesConfig.sequences.query` | string | Output field: sequencesConfig.sequences.query | | `sequencesConfig.sequences.condition` | object | Output field: sequencesConfig.sequences.condition | | `sequencesConfig.sequences.condition.groupByOption` | boolean | Output field: sequencesConfig.sequences.condition.groupByOption | | `sequencesConfig.sequences.condition.groupBy` | array | Output field: sequencesConfig.sequences.condition.groupBy | | `sequencesConfig.sequences.condition.functionType` | string | Type of the resource | | `sequencesConfig.sequences.condition.subject` | string | Output field: sequencesConfig.sequences.condition.subject | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 5 Sep 2023 20:37:23 GMT"},"reason":"OK","json_body":{"id":"3fa85f64-5717-4562-b3fc-2c963f66afa6","name":"string","description":"string","severity":"none","enabled":true,"type":"string","author":"string","lastModifier":"string","createdAt":"2023-09-09T07:57:00.686Z","updatedAt":"2023-09-09T07:57:00.686Z","autoDisabled":true,"lastTriggeredAt":"2023-09-09T07:57:00.686Z","timesTriggered":0,"t...` # Response Headers | **Header** | **Description** | **Example** | | -------------- | ----------------------------------------------------- | ---------------------------- | | content-length | The length of the response body in bytes | 140 | | content-type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Tue, 5 Sep 2023 20:37:23 GMT |